Skip to content

Make fluent-uri an optional dependency with feature flag #863

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
woodruffw-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Make fluent-uri an optional dependency with feature flag #863

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion cyclonedx-bom/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,13 @@ license.workspace = true
repository.workspace = true
rust-version.workspace = true

[features]
default = ["fluent-uri"]
fluent-uri = ["dep:fluent-uri"]

@lfrancke lfrancke May 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I honestly have no idea what best-practice is in the Rust world. This seems pretty...specific. Maybe a name like "uri-validation" might be better for this feature? And maybe it should just remove the entire function then and anything that calls it to give no false sense of security?

@woodruffw woodruffw May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, I'd say there's no really consistent idiom for feature naming in Rust -- some people prefer to give it the exact name of the dep, others prefer a descriptive name (like uri-validation). I'm happy to do whichever one you prefer!

(I see you reached the same idea about removing the entire function here, I'll go ahead with that.)


[dependencies]
base64 = "0.22.1"
fluent-uri = "0.4.1"
fluent-uri = { version = "0.4.1", optional = true }
indexmap = "2.2.2"
once_cell = "1.18.0"
ordered-float = { version = "5.0.0", default-features = false }
Expand Down
15 changes: 8 additions & 7 deletions cyclonedx-bom/src/external_models/uri.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@

use std::{convert::TryFrom, str::FromStr};

use fluent_uri::UriRef as Url;
use purl::{GenericPurl, GenericPurlBuilder};
use thiserror::Error;

Expand Down Expand Up @@ -64,8 +63,9 @@ impl AsRef<str> for Purl {
}
}

pub fn validate_uri(uri: &Uri) -> Result<(), ValidationError> {
if Url::parse(uri.0.as_str()).is_err() {
pub fn validate_uri(_uri: &Uri) -> Result<(), ValidationError> {
#[cfg(feature = "fluent-uri")]

@lfrancke lfrancke May 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My main concern is - if I understand it correctly - that validate_uri just silently skips validation when the feature is off. I am not sure I like that.

@woodruffw woodruffw May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a better option here would be to condition validate_url out entirely, i.e. only include that API if fluent-uri (or whatever we end up naming the feature) is actually enabled, which it will be by default. Would that address your concern?

(The outcome of that is that it would become structurally impossible to call validate_uri as a no-op, since it wouldn't be present when the feature is disabled.)

if fluent_uri::UriRef::parse(_uri.0.as_str()).is_err() {
return Err(ValidationError::new("Uri does not conform to RFC 3986"));
}
Ok(())
Expand All @@ -88,12 +88,13 @@ impl TryFrom<String> for Uri {
type Error = UriError;

fn try_from(value: String) -> Result<Self, Self::Error> {
match Url::parse(value.as_str()) {
Ok(_) => Ok(Uri(value)),
Err(_) => Err(UriError::InvalidUri(
#[cfg(feature = "fluent-uri")]
if fluent_uri::UriRef::parse(value.as_str()).is_err() {
return Err(UriError::InvalidUri(
"Uri does not conform to RFC 3986".to_string(),
)),
));
}
Ok(Uri(value))
}
}

Expand Down
Loading